_!SHMSFTHISTORY!_ mutex

[jwf]

hello all,

found this on a windows 7 computer and cannot find anything saying what it is used for.

_!SHMSFTHISTORY!_

googling this mutex pulls back a ton of references to various malware, backdoors, trojans, etc.

I have checked a couple of windows 7 x64 computers, including one that was freshly installed and updated to sp1 about a week ago and i see this mutex. additionally i found this mutex as well:

_SHuassist.mtx

does anyone know if there is a legitimate reason that a computer would have the following mutexes or are they exclusively used by malware?

[Ant]

"jwf" wrote:

> found this on a windows 7 computer and cannot find anything saying
> what it is used for.
>
> _!SHMSFTHISTORY!_

Why were you looking for it and how did you find it?

> googling this mutex pulls back a ton of references to various
> malware, backdoors, trojans, etc.

The problem with with checking automatic analysis of executables for
signs of malware is that creation or access of various Windows objects
(like mutants in this example) are sometimes a side effect of running
the executable. i.e. they are created by Windows components such as
the shell document library (as appears to be the case here).

> I have checked a couple of windows 7 x64 computers, including one
> that was freshly installed and updated to sp1 about a week ago and i
> see this mutex. additionally i found this mutex as well:
>
> _SHuassist.mtx

Why that one as opposed to hundreds of others that may be present on
the system?

> does anyone know if there is a legitimate reason that a computer
> would have the following mutexes or are they exclusively used by
> malware?

I can see no reason why malware would use them. They are used by
programs like explorer.exe (the GUI), Internet Explorer and Outlook
Express. Another one you might see is _!MSFTHISTORY!_ (without the
"SH" part).

[jwf]

On Monday, March 9, 2015 at 11:38:00 AM UTC-4, Ant wrote:
> "jwf" wrote:
>
> > found this on a windows 7 computer and cannot find anything saying
> > what it is used for.
> >
> > _!SHMSFTHISTORY!_
>
> Why were you looking for it and how did you find it?

found it in a memory image during forensics analysis

>
> > googling this mutex pulls back a ton of references to various
> > malware, backdoors, trojans, etc.
>
> The problem with with checking automatic analysis of executables for
> signs of malware is that creation or access of various Windows objects
> (like mutants in this example) are sometimes a side effect of running
> the executable. i.e. they are created by Windows components such as
> the shell document library (as appears to be the case here).
>
> > I have checked a couple of windows 7 x64 computers, including one
> > that was freshly installed and updated to sp1 about a week ago and i
> > see this mutex. additionally i found this mutex as well:
> >
> > _SHuassist.mtx
>
> Why that one as opposed to hundreds of others that may be present on
> the system?

because out of the dozen others i checked, this one came back with malicious references during online searches just like the one above

>
> > does anyone know if there is a legitimate reason that a computer
> > would have the following mutexes or are they exclusively used by
> > malware?
>
> I can see no reason why malware would use them. They are used by
> programs like explorer.exe (the GUI), Internet Explorer and Outlook
> Express. Another one you might see is _!MSFTHISTORY!_ (without the
> "SH" part).

https://www.google.com/#q=_!SHMSFTHISTORY!_
https://www.google.com/#q=_SHuassist.mtx

BTW i did not find any references to any legit programs using this, which is the reasoning for my question. if you can find a reference to a legit program using this, then please let me know.

[Ant]

"jwf" wrote:

> On Monday, March 9, 2015 at 11:38:00 AM UTC-4, Ant wrote:
>> "jwf" wrote:
>>> found this on a windows 7 computer and cannot find anything saying
>>> what it is used for.
>>>
>>> _!SHMSFTHISTORY!_
>>
>> Why were you looking for it and how did you find it?
>
> found it in a memory image during forensics analysis

Ok.

[snip]

>> I can see no reason why malware would use them. They are used by
>> programs like explorer.exe (the GUI), Internet Explorer and Outlook
>> Express. Another one you might see is _!MSFTHISTORY!_ (without the
>> "SH" part).
>
> https://www.google.com/#q=_!SHMSFTHISTORY!_
> https://www.google.com/#q=_SHuassist.mtx

Yes thanks, I know how to use search engines. What do you think I
based my comments about false positives on (when I mentioned side
effects)? All these results are hits from automatic analysis of
malware samples even when they appear not to be. That is quite obvious
to me as a malware researcher of some experience.

> BTW i did not find any references to any legit programs using this,

There's not much reason why you should. After all, these mutexes are
part of the internals of the Windows user interface, are undocumented
and not much use for anything else.

> which is the reasoning for my question. if you can find a reference
> to a legit program using this, then please let me know.

Of course I can and so should you if you're into forensic analysis
(look at the OS itself rather than Google). As I implied previously,
the malware references are red herrings and are caused by user
interface functions being called during the normal operation of the
executable. Note, malware may not display a user interface even when
written to run under the GUI subsystem as most are.

To be specific:

_!SHMSFTHISTORY!_ (shell microsoft history?)
Set/checked by shdocvw.dll "Shell Doc Object and Control Library"

_SHuassist.mtx (shell user assist mutex?)
Set/checked by browseui.dll "Shell Browser UI Library"

Both these DLLs are part of the OS and the mutexes get created when
certain shell functions to do with accessing the file system or the
web are called (I've made educated guesses as to the meaning of the
names). This is on XP and I doubt much has changed on Win 7. Any
programs legitimate or otherwise that make particular API calls will
cause the creation of these mutexes (MS calls them mutants).